X64

Standard ptrace injection generates detectable syscall sequences that EDR hooks intercept. Phantom Evasion Loader routes ptrace through SROP frames: crafting a fake sigcontext on the stack and firing sys_rt_sigreturn (syscall 15) causes the kernel to restore arbitrary register state — ptrace fires through the signal return path, invisible to direct syscall monitors. process_vm_writev (syscall 311) writes the full payload in one cross-process memory operation instead of 204 PTRACE_POKEDATA events. QWORD XOR decryption runs in-memory before injection. Results: 0/65 VirusTotal static, SROP + process_vm_writev invisible to Hatching Triage behavioral sandbox.

Every Linux syscall follows the x64 ABI register protocol: RAX holds the syscall number, RDI/RSI/RDX hold the first three arguments, return value lands in RAX. File descriptors 0/1/2 map to stdin/stdout/stderr — everything else (files, sockets, pipes) is a number above 2 returned by open(). .bss reserves zero-initialized RAM without increasing binary size on disk — ideal for runtime buffers. Complete implementation: sys_open → sys_read into .bss buffer → sys_write to stdout → sys_close → sys_exit.

Raw socket ICMP sniffing in x64 Assembly without libc: SOCK_RAW+IPPROTO_ICMP instructs the kernel to deliver only ICMP frames, filtering TCP/UDP at the socket layer. sys_recvfrom delivers the full frame including IP header — lea rsi,[sniffed_data+28] skips the 20-byte IPv4 header and 8-byte ICMP header to reach payload. IP address conversion: fetch each octet from sockaddr_in, repeatedly divide by 10 via div instruction, add 0x30 for ASCII, write digits backward into 16-byte buffer, insert 0x2E dot separators via conditional jump. Full source on GitHub.

Network packet IP addresses arrive in Big-Endian byte order inside sockaddr_in. x86/x64 Little-Endian architecture reverses the bytes on load — naive printing yields 5.1.168.192 instead of 192.168.1.5. The standard two-pass approach (convert forward, then reverse string) wastes memory cycles. Single-pass backward-build: start reading from the last IP octet (offset 7), write ASCII digits to the end of the output buffer, work backward simultaneously — the string forms correctly in one pass. Each octet uses div bl to extract decimal digits, add 0x30 to convert to ASCII, dot separator skipped on last octet via cmp rcx,4.

Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.